\a United States Patent and Trademark Office 
igi ■ 



UNITED STATES DEPARTMENT OF COMMERCE 
United States Patent and Trademark Office 

Address: COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Virginia 223 1 3- 1 450 
www.uspto.gov 



APPLICATION NO. 


FILING DATE 


FIRST NAMED INVENTOR 


ATTORNEY DOCKET NO. 


CONFIRMATION NO. 


09/996,154 


11/28/2001 


Phillip Andrew Porras 


SRI/4374-2 


2117 



52197 7590 10/06/2005 

MOSER, PATTERSON & SHERIDAN, LLP 

SRI INTERNATIONAL 

595 SHREWSBURY AVENUE 

SUITE 100 

SHREWSBURY, NJ 07702 



EXAMINER 



WRIGHT, NORMAN M 



ART UNIT 



PAPER NUMBER 



2134 

DATE MAILED: 10/06/2005 



Please find below and/or attached an Office communication concerning this application or proceeding. 



PTO-90C (Rev. 10/03) 



-1 

Qffir*& Arfinn Summarv 

V^fffffww nvlfvlf will f f f f f CZf w 


Application No. 

09/996,154 


Applicant(s) 

PORRAS ET AL. 


Examiner 

Norman M. Wright 


Art Unit 

2134 





- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )I3 Responsive to communication(s) filed on 22 April 2005 . 
2a)D This action is FINAL. 2b)KI This action is non-final. 

3) \Z\ Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^3 Claim(s) 1-34 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) E3 Claim(s) 1-9.12-21 and 25-34 is/are rejected. 

7) IEI Claim(s) 10.11 and 22-24 is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)O The drawing(s) filed on is/are: a)D accepted or b){Z\ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 

1 2)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 1 9(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

Certified copies of the priority documents have been received. 

Certified copies of the priority documents have been received in Application No. . 



1. D 

2. D 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 

* See the attached detailed Office action for a list of the certified copies not received. 
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Attachment(s) 

1 ) ^ Notice of References Cited (PTO-892) 

2) 0 Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) ^ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 

Paper No(s)/Mail Date 11/17/03 . 



4) Q Interview Summary (PTO-413) 

Paper No(s)/Mail Date. . 

5) □ Notice of Informal Patent Application (PTO-1 52) 

6) □ Other: . 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 7-05) 



Office Action Summary 



Part of Paper No./Mail Date 10305 
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DETAILED ACTION 
Drawings 

1 . Informal drawings have been submitted. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the 
United States before the invention thereof by the applicant for patent, or on an international application 
by another who has fulfilled the requirements of paragraphs (1 ), (2), and (4) of section 371 (c) of this 
title before the invention thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act 
of 1999 (AIPA) and the Intellectual Property and High Technology Technical 
Amendments Act of 2002 do not apply when the reference is a U.S. patent resulting 
directly or indirectly from an international application filed before November 29, 2000. 
Therefore, the prior art date of the reference is determined under 35 U.S.C. 102(e) prior 
to the amendment by the AIPA (pre-AlPA 35 U.S.C. 102(e)). 

3. Claims 1-2, 6, 25, 33-34, are rejected under 35 U.S.C. 102(e) as being clearly 
anticipated by Bernhard et al., 6,275,942, hereinafter '942. 

4. As per claims 1-2, 6, 25, 33-34, '942 teach a server, hosting an intrusion 
detection process, which is integrated into the first/ server process (abs., col. 4, lines 45 
et seq.). It has a global application interface, passing request to the server, and a web 
server (col. 2, lines 50-67 et seq., and col. 5, lines 10 et seq., and col. 6, lines 38 et 
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seq.)- The system has a processor and memory configured to perform intrusion 
detection, and a computer program product (module, ARM figs. 1-2). 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 3-5, 7,12-21 , 26-32, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Bernhard et al. '942, as applied to claims 1-2, and 6, and further in 
view of Smaha et al, U.S. Pat. No. 5,557,742, hereinafter '742. 

As per claims 3-5, 8-9, 12-18, 26-27, 31-32, '942 not explicitly taught is passing 
data to the IDS, packing a subset/extraction for analysis, a second server/IDS unit, and 
analyzing the subset, he does however teach the web server having IDS capability 
within and outside (fig. 1 , [120]). '742 teach the claimed feature of passing data to the 
IDS, packing a subset/extraction for analysis, and analyzing the subset (abs., figs. 1-5B, 
summary, and col. 4, Iines40 et seq., and elms. 2-8). It would have been obvious to one 
of ordinary skill in the art at the time of the invention to augment the invention of "942 
with the features of the misuse intrusion detection invention of '742. One of ordinary 
skill in the art would have been motivated to perform such a modification because, '942 
teaches that the use of the intrusion detection engine provides the necessary features 
carrying out his invention ('942 at col. 2, lines 1-6 et seq.). 
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7. As per claims 7, 19-21, 28-30, neither '942 nor '742 teaches the use of emerald 
format/expert analysis, an apache web server. The examiner takes official notice of 
both the motive and modification necessary to utilize the combined invention on such 
types of servers, and to analyze or format the data as recited. It would have been 
obvious to one of ordinary skill in the art, at the time of the invention that, the invention 
of '942 and '742 could be utilized to display, analyze and carry out the process in a 
particular server. The process could easily be carried out with the proper formatting of 
the configuration of an intrusion detection system. Moreover, one of ordinary skill in the 
art would have had a desire to utilize these inventions in whatever, field of use/ 
environment they desired, because of the portability of the invention in various computer 
environments ('942 at col. 2, lines 65 et seq., and '742 at col. 14, lines 15 et seq.). 

Allowable Subject Matter 

8. Claims 10-1 1 and 22-24 are objected to as being dependent upon a rejected 
base claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

Conclusion 

9. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Norman M. Wright whose telephone number is (571) 
272-3844. The examiner can normally be reached on weekdays, from 8AM to 4 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Greg Morse can be reached on (571) 272-3838. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 




